Explanation:
< Device identity can be stored in Azure AD. # Yes
A single system-assigned managed identity can be used by multiple Azure resources. # No If you delete an Azure resource that has a user-assigned managed identity, the managed identity is deleted automatically. # No From Microsoft Entra ID (Azure AD) device documentation: Azure AD holds device objects for registration and join states. The docs state that device identities are maintained in Azure AD: "Azure AD device objects represent registered and joined devices so they can be managed and secured." and "Devices can be Azure AD registered, Azure AD joined, or hybrid Azure AD joined." These statements confirm that device identity is stored in Azure AD, so the first item is Yes.
Regarding managed identities: Microsoft's description of system-assigned managed identity explains, "The identity is created in Entra ID and is tied to the lifecycle of that Azure resource." and "Only that resource can use this identity." Because a system-assigned identity is unique to a single resource and cannot be shared, the second statement is No.
For user-assigned managed identity, the documentation says, "A user-assigned managed identity is a standalone Azure resource." and "It can be assigned to one or more Azure service instances and is managed independently." Additionally, "When you delete the Azure resource, the user-assigned identity is not deleted." Therefore, deleting a resource does not automatically delete the user-assigned identity, making the third statement No.

In Microsoft 365, Data Loss Prevention (DLP) policies are designed to "help you identify, monitor, and automatically protect sensitive information" across services such as Exchange Online, SharePoint Online, OneDrive, and Microsoft Teams. Microsoft's guidance explains that DLP uses sensitive information types- including built-in classifiers like Credit Card Number-to detect when content matches a defined pattern and then enforce protective actions. With DLP, you can create rules that trigger when email messages contain customer lists with credit card numbers, and choose actions to block the message, restrict access, or notify and educate users via policy tips and incident reports. Microsoft further notes that DLP "prevents the accidental sharing of sensitive information," can require user justification to override, and supports granular conditions (e.g., number of matches, recipients internal vs. external) to ensure that only risky transmissions are stopped.
By applying a DLP policy to Exchange with the Credit Card Number sensitive info type, an organization can block or quarantine outbound mail that includes those numbers, thereby reducing regulatory and data- exposure risk. Other options listed-retention policies, conditional access, and information barriers-serve different purposes (data lifecycle, access/authentication conditions, and restricting communication between groups) and do not inspect message contents for sensitive data. Hence, DLP policies are the correct control to restrict sending emails that contain customer lists and associated credit card numbers.

Explanation:
Security Center
Reference:
https://docs.microsoft.com/en-us/azure/security-center/secure-score-access-and-track

Explanation:

In Microsoft's Security, Compliance, and Identity portfolio, Microsoft Defender for Cloud Apps (formerly Microsoft Cloud App Security) integrates directly with Microsoft Entra Conditional Access to provide Conditional Access App Control-Microsoft's real-time session control. Microsoft's documentation describes this capability as enabling organizations to "monitor and control user sessions in real time" and to "protect downloads, restrict uploads, block copy/paste and print, and apply access or session policies" for sanctioned and unsanctioned applications. The enforcement is achieved through a reverse-proxy session that is invoked by Conditional Access policy decisions, allowing continuous inspection and dynamic controls after authentication.
By contrast, other options in the list do not offer real-time session enforcement via Conditional Access. Azure AD Privileged Identity Management (PIM) focuses on just-in-time role activation, approval workflows, and access reviews for privileged accounts-not session control of app usage. Microsoft Defender for Cloud provides cloud security posture management and workload protection across Azure, multicloud, and hybrid resources-again, not Conditional Access-based user session governance. Microsoft Sentinel is a SIEM
/SOAR solution used for ingestion, detection, investigation, and response; it does not apply Conditional Access policies to control user sessions. Therefore, the service that can use Conditional Access policies to control sessions in real time is Microsoft Defender for Cloud Apps through Conditional Access App Control.

In Microsoft's Security, Compliance, and Identity guidance, Azure AD Privileged Identity Management (PIM) is the service used to manage, control, and monitor access to important resources in Azure and Microsoft 365. The documentation explains that PIM enables "just-in-time" and "time-bound" activation of privileged roles, requiring users to elevate only when needed and for a limited duration. PIM policies can require approval before a role is activated, enforce multifactor authentication, capture business justification, send notifications, and maintain detailed auditing and access review records. These controls are designed to reduce the risk associated with standing administrative privileges by ensuring that elevation is temporary, approved, and tracked.
By contrast, Windows Hello for Business provides strong, device-bound authentication; Azure AD Identity Protection focuses on detecting and remediating risky sign-ins and users; and Azure AD Access Reviews periodically reattest existing assignments but do not provide the on-demand, approval-based, time-limited activation of roles. Therefore, when the requirement is approval-based, time-bound role activation, Microsoft' s prescribed capability is Azure AD PIM, which delivers just-in-time elevation with approvers, duration limits, and audit/logging to support least privilege and Zero Trust operational practices.